PERSONAL DATA PROTECTION AND COOKIE POLICY

Personal Data Protection Policy and Information Provided by the Controller to the Data Subject When Collecting Personal Data from the Data Subject, and Cookie Information for the dobrosteel.sk Online Store

I. Controller

1.1. Identity and contact details of the Controller:

Business name: DOBROSTEEL s. r. o.

Registered office: Bukovská cesta 816, 906 13 Brezová pod Bradlom, Slovak Republic

Registered in: Commercial Register of the District Court Trenčín, Section Sro, Insert No. 30536/R

Company ID No. (IČO): 47758619

Tax ID No. (DIČ): 2024091509

VAT ID No.: SK2024091509

The Seller is a VAT payer.

1.2. Contact details of the Controller:

Email: dobrocanova@dobrosteel.sk

Telephone: 0908892058

1.3. Address of the Controller for written correspondence:

DOBROSTEEL s. r. o.
Bukovská cesta 816
906 13 Brezová pod Bradlom
Slovakia

1.4.

In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter referred to as the “Regulation” or “GDPR”), as well as in accordance with Act No. 18/2018 Coll. on Personal Data Protection and on Amendments and Supplements to Certain Acts, as amended, and Act No. 452/2021 Coll. on Electronic Communications, as amended, the Controller hereby provides the Data Subject – the Buyer – from whom the Controller – the Seller – obtains personal data relating to them, with the following information, instructions and explanations.

II. References

2.1.

This Personal Data Protection Policy and Information forms an integral part of the General Terms and Conditions published on the Seller's Website.

2.2.

The Seller informs consumers that there are no specific applicable codes of conduct to which the Seller has committed itself. A code of conduct means an agreement or set of rules defining the conduct of a Seller who has undertaken to comply with such a code in relation to one or more specific commercial practices or business sectors, where such rules are not established by law, another legal regulation or a measure of a public authority, and information on how consumers may become familiar with or obtain the wording of such codes.

III. Retention Period

3.1.

The Controller retains the personal data of the Data Subject only for the period necessary to fulfil the purposes of the contract and for subsequent archiving in accordance with statutory retention periods imposed on the Controller by applicable legislation.

If the Data Subject has consented to receiving promotional emails and similar offers, the personal data of the Data Subject shall be processed for these purposes until the Data Subject withdraws their consent, but for no longer than 10 years.

IV. Processed Personal Data

4.1.

The Controller processes the following personal data on its website:

• first name,
• surname,
• residential address,
• email address,
• home telephone number,
• mobile telephone number,
• billing address,
• delivery address,
• data obtained from cookies,
• IP address.

V. Contact Details of the Data Protection Officer

5.1.

The Controller has not appointed a Data Protection Officer in accordance with Regulation (EU) 2016/679 concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data.

5.2.

The Controller is also the Seller within the meaning established in the General Terms and Conditions of this website.

VI. Purposes of Processing the Personal Data of the Data Subject and the Processing Period

6.1.

The purposes of processing the personal data of the Data Subject include, in particular:

6.1.1.

Recording, creating and processing contracts and customer data for the purpose of concluding contracts with third parties.

6.1.2.

Processing accounting documents and documents related to the Controller's business activities.

6.1.3.

Compliance with legal regulations relating to the archiving of documents and records, for example pursuant to Act No. 431/2002 Coll. on Accounting, as amended, and other applicable regulations.

6.1.4.

The Controller's activities related to fulfilling requests, orders, contracts and similar arrangements of the Data Subject.

6.1.5.

Newsletters, marketing and similar promotional activities of the Controller, where the Data Subject has granted consent to such marketing and promotional activities.

VII. Legal Basis for Processing the Personal Data of the Data Subject

7.1.

Where the Controller processes personal data on the basis of the consent of the Data Subject, such processing shall commence only after the Data Subject has granted the relevant consent.

7.2.

Where the Controller processes the personal data of the Data Subject for the purpose of pre-contractual negotiations and for the conclusion and performance of a purchase contract, including the related delivery of goods, products or services, the Data Subject is obliged to provide the personal data necessary for the proper performance of the purchase contract. Otherwise, performance cannot be ensured.

Personal data for this purpose are processed without the consent of the Data Subject.

VIII. Recipients or Categories of Recipients of Personal Data

8.1.

Recipients of the personal data of the Data Subject may include:

8.1.1.

The statutory bodies or members of the statutory bodies of the Controller.

8.1.2.

Persons performing work activities for the Controller within an employment relationship or a similar relationship.

8.1.3.

Commercial representatives of the Controller and other persons cooperating with the Controller in performing the Controller's tasks.

For the purposes of this document, employees of the Controller shall include all natural persons performing dependent work for the Controller on the basis of an employment contract or agreements on work performed outside an employment relationship.

8.1.4.

Recipients of the personal data of the Data Subject may also include the Controller's collaborators, business partners, suppliers and contractual partners, in particular:

• accounting companies,
• companies providing services related to the creation and maintenance of software,
• companies providing legal services,
• companies providing consultancy services,
• companies ensuring the transport and delivery of products to Buyers and third parties,
• marketing companies,
• companies operating social networks,
• companies providing payment gateways and other payment methods.

8.1.5.

Recipients of personal data may also include courts, law enforcement authorities, tax authorities and other public authorities where required by law.

Personal data shall be provided by the Controller to the relevant authorities and public institutions on the basis of and in accordance with the laws of the Slovak Republic.

8.1.6. List of Third-Party Processors and Recipients Processing the Personal Data of the Data Subject:

TOPTRANS EU, a.s.
Na Priehon 50, 949 05 Nitra
Company ID No.: 36703923
– third party providing transport services

Geis SK s.r.o.
Trňanská 6, 960 01 Zvolen
– third party providing transport services

Tatra banka, a.s.
Hodžovo námestie 3, 811 06 Bratislava 1
– third party providing payment gateway services

AUDITIS, s.r.o.
Hollého 744, 905 01 Senica
– third party providing accounting services

IX. Information on the Transfer of Personal Data to Third Countries and the Retention Period

9.1.

Transfers to third countries apply.

The Controller transfers personal data in the form of cookies to third countries to the following entities:

Google Pixels
Google HQ
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

Further information on privacy protection is available at:

https://business.safety.google/privacy/

https://business.safety.google/privacy/google-services/

https://business.safety.google/privacy/display-advertising/

X. Information on the Relevant Rights of the Data Subject

10.1.

The Data Subject has, among others, the following rights:

10.1.1.

The rights listed in this Section 10.1 are without prejudice to other rights of the Data Subject.

10.1.2. Right of Access under Article 15 GDPR

The Data Subject has the right to obtain confirmation from the Controller as to whether personal data relating to them are being processed and, where that is the case, to obtain information about the scope and content of such processing.

The Data Subject has the right to obtain information, in particular, regarding:

• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom personal data have been or will be disclosed, particularly recipients in third countries or international organisations;
• the envisaged period for which personal data will be stored or, where this is not possible, the criteria used to determine that period;
• the existence of the right to request rectification or erasure of personal data or restriction of processing;
• the existence of the right to object to processing;
• the right to lodge a complaint with a supervisory authority;
• where personal data are not collected from the Data Subject, any available information regarding their source;
• the existence of automated decision-making, including profiling pursuant to Article 22(1) and (4) GDPR, including meaningful information about the logic involved and the significance and envisaged consequences of such processing;
• appropriate safeguards pursuant to Article 46 GDPR where personal data are transferred to a third country or international organisation.

10.1.3.

The Data Subject has the right to obtain a copy of the personal data being processed, provided that the right to obtain such a copy does not adversely affect the rights and freedoms of others.

10.1.4. Right to Rectification under Article 16 GDPR

The Data Subject has the right to obtain from the Controller, without undue delay, the rectification of inaccurate personal data concerning them.

The Data Subject also has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

The Data Subject also has the right to erasure of personal data (“the right to be forgotten”) pursuant to Article 17 GDPR.

10.1.5. Right to Erasure

The Data Subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the Data Subject withdraws consent on which the processing is based and there is no other legal ground for processing;
• the Data Subject objects to processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or the Data Subject objects to processing pursuant to Article 21(2) GDPR;
• the personal data have been unlawfully processed;
• the personal data must be erased for compliance with a legal obligation under European Union law or the law of a Member State to which the Controller is subject;
• the personal data have been collected in relation to the offer of information society services pursuant to Article 8(1) GDPR.

10.1.6.

Where the Controller has made the personal data of the Data Subject public, the Controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing such personal data that the Data Subject has requested the erasure of any links to, copies or reproductions of such personal data.

However, the right to erasure under Article 17(1) and (2) GDPR shall not apply where processing is necessary:

10.1.7.

For exercising the right of freedom of expression and information.

10.1.8.

For compliance with a legal obligation requiring processing under European Union law or the law of a Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.

10.1.9.

For reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) GDPR.

10.1.10.

For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right referred to in Article 17(1) GDPR is likely to render impossible or seriously impair the achievement of the objectives of such processing, or for the establishment, exercise or defence of legal claims.

10.1.11. Right to Restriction of Processing under Article 18 GDPR

The Data Subject has the following rights:

10.1.12.

The right to obtain restriction of processing from the Controller where one of the following applies:

• the Data Subject contests the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
• the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests restriction of their use instead;
• the Controller no longer needs the personal data for the purposes of processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
• the Data Subject has objected to processing pursuant to Article 21(1) GDPR pending verification whether the legitimate grounds of the Controller override those of the Data Subject.

10.1.13.

Where processing has been restricted, such personal data shall, with the exception of storage, be processed only with the consent of the Data Subject or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

10.1.14.

The Data Subject has the right to be informed before the restriction of processing is lifted.

10.1.15. Right to Notification Regarding Rectification, Erasure or Restriction under Article 19 GDPR

The Data Subject has the right to require the Controller to communicate any rectification or erasure of personal data or restriction of processing carried out pursuant to Articles 16, 17(1) and 18 GDPR to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

The Data Subject also has the right to be informed by the Controller about such recipients upon request.

10.1.16. Right to Data Portability under Article 20 GDPR

The Data Subject has the right to receive personal data concerning them which they have provided to the Controller in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from the Controller, where:

a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR; and

b) the processing is carried out by automated means.

10.1.17.

The right to receive personal data in a structured, commonly used and machine-readable format and to transmit such data to another controller shall not adversely affect the rights and freedoms of others.

10.1.18.

The Data Subject has the right to have personal data transmitted directly from one controller to another, where technically feasible.

10.1.19. Right to Object under Article 21 GDPR

The Data Subject has the following rights:

10.1.20.

The right to object, at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.

10.1.21.

Where the Data Subject exercises the right to object, the Controller shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for processing which override the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or defence of legal claims.

10.1.22.

The right to object at any time to the processing of personal data concerning the Data Subject for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

Where the Data Subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

10.1.23.

In the context of the use of information society services, the Data Subject has the right to exercise their right to object by automated means using technical specifications.

10.1.24.

The Data Subject has the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

10.1.25. Rights Related to Automated Individual Decision-Making under Article 22 GDPR

The Data Subject has the following rights:

10.1.26.

The Data Subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except where such decision:

a) is necessary for entering into or performing a contract between the Data Subject and the Controller;

b) is authorised by European Union or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard the rights, freedoms and legitimate interests of the Data Subject; or

c) is based on the explicit consent of the Data Subject.

XI. Information on the Right of the Data Subject to Withdraw Consent to the Processing of Personal Data

11.1.

The Data Subject has the right to withdraw their consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

The Data Subject may withdraw their consent to the processing of personal data in full or in part at any time.

A partial withdrawal of consent may relate to a specific type of processing operation or processing operations, while the lawfulness of processing operations not affected by the withdrawal shall remain unaffected.

A partial withdrawal of consent may also relate to one or more specific purposes of processing personal data, while the lawfulness of processing for other purposes shall remain unaffected.

The Data Subject may exercise the right to withdraw consent in writing by sending a letter to the Controller's registered office as recorded in the Commercial Register at the time of withdrawal, or electronically by sending an email to the Controller's email address stated in this document.

XII. Information on the Right of the Data Subject to Lodge a Complaint with a Supervisory Authority

12.1.

The Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, if they consider that the processing of personal data concerning them infringes the GDPR.

This right is without prejudice to any other administrative or judicial remedy.

The Data Subject has the right to be informed by the supervisory authority with which the complaint was lodged about the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

12.2.

The supervisory authority in the Slovak Republic is:

Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovakia

Telephone: +421 2 32 31 32 14
Email: statny.dozor@pdp.gov.sk

XIII. Information Related to Automated Decision-Making, Including Profiling

13.1.

As the Controller does not process the personal data of the Data Subject by means of automated decision-making, including profiling referred to in Article 22(1) and (4) GDPR, the Controller is not required to provide information pursuant to Article 13(2)(f) GDPR concerning automated decision-making, including profiling, the logic involved, and the significance and envisaged consequences of such processing for the Data Subject.

This does not apply.

XIV. Personal Data Protection and the Use of Cookies – Information and Explanation Regarding Cookies, Scripts and Pixels

14.1. The Controller provides the following brief explanation of the function of cookies, scripts and pixels:

14.1.1. Cookies

Cookies are text files containing a small amount of information which are downloaded to your device when you visit a website.

Cookies enable a website to remember information about your actions and preferences for a certain period of time, such as your login name, language, font size and other display settings, so that you do not have to re-enter them when you return to the website or browse from one page to another.

Scripts are parts of program code used to ensure the proper and interactive functioning of websites. Such code is executed on the Controller's server or on your device.

Pixels are small, invisible pieces of text or images on a website used to monitor website traffic. For this purpose, various data may be stored through pixels.

14.1.2. Types of Cookies

Necessary cookies – ensure the proper functioning and use of the Controller's website. These cookies are used without consent.

Functional cookies – relate to users' choices regarding the use of cookies on the website, including options to accept, reject or customise cookie settings based on their privacy preferences.

Statistical cookies – enable the Controller to obtain statistics regarding the use of its website. These cookies are used only with consent.

Advertising cookies – are used to create advertising profiles and for similar marketing activities. These cookies are used only with consent.

14.2. How to Control Cookies

14.2.1.

You can control and/or delete cookies as you wish. Further details are available at aboutcookies.org.

You can delete all cookies that are already stored on your computer or other device, and most browsers can be configured to prevent cookies from being stored.

14.3.1. Cookies Used

Necessary Cookies

_lb_ccc

First-party – 1 year

This cookie is used to store the user's consent to the use of cookies on the website, ensuring compliance with legal requirements regarding consent for certain categories of cookies.

_lb

First-party – Session

This cookie is used for load-balancing purposes to ensure that website requests are directed to the same server during each browsing session, thereby improving website performance and user experience.

cart

First-party – 4 weeks and 2 days

This cookie is generally provided by Shopify and is used in connection with the shopping cart.

Functional Cookies

login_admin_lang_code

First-party – 1 day

This cookie is used to remember the user's language preference for the website's administrative interface in order to improve the user experience.

themeColor

First-party – Session

This cookie is used to store the user's preference regarding the website's theme colour, ensuring a consistent and personalised visual experience across sessions.

sphf_filter

First-party – Session

This cookie is used to store user preferences and selections in order to improve website functionality, such as filtering options and search preferences.

Statistical Cookies

_lb_id

First-party – 1 year

This cookie is used to track user behaviour and preferences in order to improve the overall website experience.

_ga_PVMVK89JTK

More information: .dobrosteel.sk / First-party – 1 year and 1 month

This cookie is used by Google Analytics to maintain session state.

_ga

First-party – 1 year and 1 month

The name of this cookie is associated with Google Universal Analytics, which is a significant update to Google's commonly used analytics service.

This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page request and is used to calculate visitor, session and campaign data for website analytics reports.

14.3.2. Cookies Made Available to Third Parties

Google HQ
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

Further information on privacy protection is available at:

https://business.safety.google/privacy/

https://business.safety.google/privacy/google-services/

https://business.safety.google/privacy/display-advertising/

XV. Final Provisions

15.1.

This Personal Data Protection Policy and Cookie Policy form an integral part of the General Terms and Conditions and the Complaints Procedure.

The documents – the General Terms and Conditions and the Complaints Procedure of this Website – are published on the domain of the Seller's Website.

15.2.

This Personal Data Protection Policy shall become valid and effective upon its publication on the Seller's Website on 17 August 2026.

This online store is certified by pravoeshopov.sk.